I wonder about this:
"Every scenario that involves possibly transmitting passwords in the
clear can be redesigned for the desired functionality without a
cleartext password transmission."
-- http://www.w3.org/2001/tag/doc/passwordsInTheClear-52-20080602
W3C has tried to stamp out cleartext passwords on its own
web site a few times, but one of the main blockers, aside from
buggy support for digest in various bits of software, is delegation.
W3C has a few forms-based services that use
cleartext passwords for delegation; e.g. our XSLT service
http://www.w3.org/2005/08/online_xslt/#authinfo
If you want to use the service on password-protected pages,
you just put the credentials in a form and it uses them.
The main use case is password-protected pages inside w3.org
(though I'm not sure that's technically enforced) so it's
not really all *that* much less secure than sending credentials
to get the actual password-protected page. Still, yes,
it makes many of us uncomfortable.
How can these delegated services be "redesigned for the desired
functionality without a cleartext password transmission."
The W3C systems team has been looking at this for several
years without finding a solution.
--
Dan Connolly, W3C http://www.w3.org/People/Connolly/
gpg D3C2 887B 0F92 6005 C541 0875 0F91 96DE 6E52 C29E